System and methods for weak authentication data reinforcement

ABSTRACT

Systems and methods for weak authentication data reinforcement are described. In some embodiments, authentication data is received in a request to authenticate a user. In response to detecting weak authentication data, the systems and methods determine whether the identifier of the device was previously associated with a human user and whether the authentication data is weak. An example embodiment may include initiating a verification process in response to determining that the authentication data is weak and that the identifier of the device was not previously associated with a human user.

CLAIM OF PRIORITY

This application is a continuation of and claims the benefit of priorityto U.S. patent application Ser. No. 14/262,112, filed on Apr. 25, 2014,which is a continuation of and claims the benefit of priority to U.S.patent application Ser. No. 13/608,867, filed on Sep. 10, 2012, now U.S.Pat. No. 8,713,657, which is a continuation of and claims the benefit ofpriority to U.S. patent application Ser. No. 12/103,539, filed on Apr.15, 2008, now U.S. Pat. No. 8,266,682, which claims the benefit ofpriority under to U.S. Provisional Patent Application Ser. No.60/956,854, filed Aug. 20, 2007 the benefit of priority of each of whichis claimed hereby, and each of which are incorporated by referenceherein in its entirety.

TECHNICAL FIELD

This patent document pertains generally to information security, andmore particularly, but not by way of limitation, to weak authenticationdata reinforcement.

BACKGROUND

A computer system may require that a user is authenticated or verifiedbefore the user is granted access to its content. One way toauthenticate or verify a user is by requiring that the user enter ausername and password combination known by the computer and the user.

BRIEF DESCRIPTION OF THE DRAWINGS

In the drawings like numerals describe substantially similar componentsthroughout the several views. Like numerals having different lettersuffixes represent different instances of substantially similarcomponents. The drawings illustrate generally, by way of example, butnot by way of limitation, various embodiments discussed in the presentdocument.

FIG. 1 is a block diagram illustrating a communication system, inaccordance with an example embodiment;

FIG. 2 is a high-level entity-relationship diagram, illustrating varioustables, in accordance with an example embodiment;

FIG. 3 shows an authentication table including authentication data, inaccordance with an example embodiment;

FIG. 4 shows a weak authentication table including weak authenticationdata, in accordance with an example embodiment;

FIG. 5 shows a safe device table including safe device data, inaccordance with an example embodiment;

FIG. 6 shows a safe user table including safe user data, in accordancewith an example embodiment;

FIG. 7 shows a safe user/device table including safe user and safedevice data, in accordance with an example embodiment;

FIG. 8 is a flow chart illustrating a method of weak authentication datalimiting, in accordance with an example embodiment;

FIG. 9 is a flow chart illustrating a further method of weakauthentication data limiting, in accordance with an example embodiment;

FIG. 10 is a block diagram illustrating an electronic system, inaccordance with an example embodiment;

FIG. 11 is a block diagram illustrating multiple applications that areprovided as part of networked system, in accordance with an exampleembodiment;

FIGS. 12A and 12B are graphical flow diagrams illustrating a method ofweak password limiting, in accordance with an example embodiment;

FIG. 13 shows an example interface screen including a verificationchallenge, in accordance with an example embodiment;

FIG. 14 shows an example email notification providing an option toreplace a weak password, in accordance with an example embodiment; and

FIG. 15 is a block diagram illustrating a computer system, in accordancewith an example embodiment.

DETAILED DESCRIPTION

In attacks on a network system, malicious code may obtain a userpassword by trying different username/password combinations until themalicious code successfully identifies a username and correspondingpassword (e.g., a substring match) that allow access to the networksystem. A weak password may be, for example, a password that is a subsetof the username. Malicious code may limit a brute force attack to weakpasswords. Once password protection has been breached, the fraudster canfraudulently sell, buy or spam users to lead users away from pages ofthe system web site.

An example embodiment includes a technology used to prevent a softwareapplication from fraudulently obtaining a username and password (e.g.,through a brute force attack) to be used to access a machine belongingto a network system. The example embodiment includes a network systemsuch as a commerce, publication or financial system that includes aninterface connecting users over the network. The network system receivesauthentication requests from users to access one or more of itsmachines. In some example embodiments, the authentication requestsinclude a username and password.

The example technology includes a weak password detection module withaccess to one or more tables in a system database. An example weakpassword detection module accesses one or more of the tables to detectthat a submitted password is a weak password. Whether a password is weakmay be defined by a system administrator. There are various factors tobe considered when defining the attributes that make a password weak. Insome embodiments, a password is weak if the password is a substring ofthe username. Passwords known to be weak (e.g., known by systemadministrators) may populate the tables. Alternatively or additionally,weak passwords may be derived in real time by the weak passworddetection module.

The example technology includes a user/device detection module that alsoaccesses a table in order to determine whether the source of thepassword (e.g., the user of a device that submitted the password) haspreviously been recognized as being human. An Internet Protocol (IP)address or device fingerprint (e.g., one or more attributes of a device)may be associated with a network device that is considered to be safe.Some example user/device detection modules may reference a cookie orcookies on the device of the user to determine whether an IP address orfingerprint associated with the submitted username and passwordcorresponds to a safe user device.

In an example embodiment, if the user/device detection module determinesthat the user has not previously been recognized as being human, achallenge module in the example embodiment initiates achallenge-response test (e.g., a Completely Automated Public Turing testto tell Computers and Humans Apart (CAPTCHA) to determine whether theuser of the device is currently recognized as being human.

If the user/device detection module determines that the user haspreviously been recognized as being human or the challenge moduledetermines that the user is currently recognized as being human, anauthentication module in an example embodiment may enforce a userauthentication policy. Conversely, if the user is not recognized asbeing human, the authentication module is to stop the initiation of theauthentication process.

Some example embodiments may further include an option module to providean authenticated user an option, prior to the authentication modulegranting access to the system, to replace their weak password with adifferent password that is not weak. Example embodiments may alsoinclude an option module to generate an electronic communication orprovide an electronic link giving the recipient the option to changepasswords.

A trend monitoring module may be employed within an example networksystem to count or monitor the number of CAPTCHA tests issued to users,the number of tests solved and the number of successful authentications.The trend monitoring module may measure an impact on a flow oftransactions in the example commerce system based on the total number ofCAPTCHAs issued, the number solved and the number of successfultransactions.

This overview is intended to provide an overview of the subject matterof the present patent application. It is not intended to provide anexclusive or exhaustive explanation of what is claimed. The detaileddescription is included to provide further information about the subjectmatter of the present patent application.

The following detailed description includes references to theaccompanying drawings, which form a part of the detailed description.The drawings show illustrations in accordance with example embodiments.These embodiments, which are also referred to herein as “examples,” aredescribed in enough detail to enable those skilled in the art topractice the current subject matter. The embodiments may be combined,other embodiments may be utilized, or structural, logical and electricalchanges may be made without departing from the scope of what is claimed.The following detailed description is, therefore, not to be taken in alimiting sense, and the scope is defined by the appended claims andtheir equivalents.

In this document, the terms “a” or “an” are used, as is common in patentdocuments, to include one or more than one. In this document, the term“or” is used to refer to a nonexclusive or, such that “A or B” includes“A but not B,” “B but not A,” and “A and B,” unless otherwise indicated.Furthermore, all publications, patents, and patent documents referred toin this document are incorporated by reference herein in their entirety,as though individually incorporated by reference. In the event ofinconsistent usages between this document and those documents soincorporated by reference, the usage in the incorporated reference(s)should be considered supplementary to that of this document; forirreconcilable inconsistencies, the usage in this document controls.

FIG. 1 is a block diagram illustrating a communication system 100, inaccordance with an example embodiment. The communication system 100 isshown to include a user interface 102 coupled to a machine 106, viacommunication channels 103, 105 and a communication bus 104.

The user interface 102 may be a hardware user interface to allow forcommunication with software and/or hardware on the machine 106. In anexample embodiment, the communication bus 104 is a Universal Serial Bus(USB) and the user interface 102 is a port connecting to the USB. Theuser interface 102 may alternatively or additionally be a software userinterface on a user device (not shown) to allow for communication withhardware and/or software on the machine 106.

In some example embodiments, the user interface 102 may include webbrowser (not shown) that may be used to request access to the machine106 via the Internet. In those particular example embodiments, thecommunication bus 104 may include the Internet.

The example machine 106 includes a security module 108. It is to beappreciated that the security module 108, and the functionalityexplained in the various example embodiments included herein, mayoperate outside of the machine 106. The security module 108 is shown toinclude multiple other modules (each discussed in turn below) andillustrates their structural and/or communicatory relationships to oneanother. Each of the modules serves to implement functionality describedin the example embodiments. The modules may be software instructions orhardware such as hardwired circuitry programmed to implement logic. Someexample embodiments may include modules that are a combination ofsoftware and hardware or hardwired circuitry, etc.

The example security module 108 includes a weak authentication detectionmodule 110, a challenge module 130, an authentication module 120, atrend monitoring module 150 and a communication module 140, which areall communicatively coupled with one another via the communicationchannels 107, 109, 111, 113 and 115 respectively. The security module108 is further shown to include database(s) 114 communicatively coupledto and accessible by the modules via communication channel 117 and anoption module 112. The option module 112 is shown to be coupled with theweak authentication detection module 110, the challenge module 130, thecommunication module 140 and the authentication module 120 via thecommunication channels 119, 125, 121 and 123 respectively. It is to beappreciated that the modules and database(s) referenced above need notbe enclosed within, or confined to, the security module 108. Exampleembodiments may include maintaining the structural and/or communicatoryrelationships between the modules, independent of the security module108.

The communication module 140 may be used to facilitate all types ofcommunications associated with the security module 108 via thecommunication bus 104 and/or the communication channels 103, 105, 107,109, 111, 113, 115, 117, 119, 121, 123, and 125. The communications mayinclude those between the modules within the security module 108 andthose made via the user interface 102. Any of the various communicationprotocols may be employed.

The weak authentication detection module 110 is to receive userauthentication requests via the user interface 102 and inspect theauthentication requests to determine whether authentication dataprovided in a request is weak. The weak authentication detection module110 may identify weak authentication data by referencing a list of knownweak authentication data (e.g., data organized in the database 114,discussed in more detail below).

In an example embodiment, a user may include a human being or softwareassociated with the user interface 102. As explained above, the userinterface may be connected to the machine 106 via the communication bus104, which may connect a further device (not shown) that is local to orremote from (e.g., over a wide area network (WAN)) the machine 106.

In the various example embodiments discussed herein, authentication dataincludes usernames and passwords. Other authentication data (e.g.,hardware tokens, biometric devices, other forms of shared secretsincluding transactional, or behavioral data, PIN numbers) known in theart may be employed in other example embodiments. The attributes thatmake authentication data weak may depend on the nature of theauthentication data. When authentication data is a password, theauthentication data may be considered to be weak if the password isconsidered to be weak. Whether a password is weak may be determined invarious ways. In an example embodiment, a weak password is a passwordthat is a substring of the username submitted with the password.Likewise, a username may be considered weak if the username is asubstring of the password. It is to be noted that example techniquesdescribed with respect to weak passwords may also be implemented withrespect to weak usernames.

In an example case, the password “123” would be considered a weakpassword if the corresponding username was “ABC123.” The password “123”would not be considered a weak password if the corresponding usernamewas “ABC456” because then the password “123” would not be a subset orsubstring of the username.

In an example embodiment, substrings may be configurable to vary thestrictness of a security policy. For example, the system may beconfigured to match any “2 character substrings”, in which case for theusername “testusername” and password “Stalingrad,” the password would beconsidered weak because the substring “st” in the “Stalingrad” is a 2character substring of the testusername.

The database 114 may include a data structure stored in a memory orstorage device. In some example embodiments, the data structure employedis a relational database, but any appropriate data structure wouldsuffice. In an example embodiment, the database 114 holds a list ofknown weak passwords (e.g., weak authentication data) to be accessed bythe weak authentication detection module 110. The database may also holda list of machines and/or users that are considered “safe,” perhapsbecause the machine and/or user has previously interacted with oraccessed the machine 106. More details on the contents of the exampledata structure are described below.

The challenge module 130 may test whether a human being is associatedwith a password received by the device. In an example embodiment, theuser is challenged with a CAPTCHA image designed to test whether theuser is a human being. If the user is not determined to be human, theuser may be malicious code or some other software, etc.

The user/device detection module 132 is to determine whether a receivedusername and password have been submitted by a user and/or device isconsidered to be “safe.” A safe user may be a user who has previouslybeen determined to be a human user or is otherwise considered to besafe. A safe device may be a device that is associated with a human useror is otherwise considered to be safe. The user/device detection module132 may reference the database 114 and/or a user device (e.g., a cookiein the user's device) to determine whether the user and/or device areconsidered to be safe.

The authentication module 120 is to authenticate a user's identity. Todo so, the authentication module 120 may compare a submitted usernameand password with a list of registered usernames and passwords. The listof usernames and passwords may be stored in and accessed from thedatabase 114. If the authentication module 120 is able to match thesubmitted username and password with a registered username and password,then the user may be granted a level of access to the machine 106.Otherwise, the user is not granted access to the machine 106.

The option module 112 is to present a user with an option to change aweak password to a password that is not considered to be weak. In anexample embodiment, when the weak authentication detection module 110determines a password to be weak and the authentication module 120authenticates the user, the option module 112 may present the user withan option to change the user's password. The option module 112 mayprovide the option via an email communication giving a recipient theoption to initiate the password change by following an Internet linkfrom the email address to a web page hosted by the network system.Alternatively or additionally, the option module 112 may provide theoption as a web link to the web page at the time the weak password issubmitted.

The trend monitoring module 150 is to monitor the number of challengespresented to users by the challenge module 130 and the number ofchallenges that are solved by the users. An example analysis of the datacollected above may yield a number malicious code attempts to gainaccess to the machine 106. Further, it may be useful to track the effectof enforcing the challenge on users to determine whether users arewilling to solve the challenge or opt to abandon the login procedure(e.g., and potential transactions once logged in).

FIG. 2 is a high-level entity-relationship diagram, illustrating varioustables 200 that may be maintained within the database 114, and that areutilized by and support the modules within the security module 108.

A user table 202 contains a record for each user registered to accessthe machine 106 and may include various identifiers depending on thepurpose of accessing the machine 106. For example, if the examplemachine 106 were part of a commerce system, registration information mayinclude address and financial instrument information pertaining to eachsuch registered user.

The tables 200 also include an authentication table 204 in whichauthentication data corresponding to each registered user is maintained.FIG. 3 shows an authentication table 300 including authentication data,in accordance with an example embodiment. The table is shown to includea user column 304 and columns 306, 308, 310 for each set ofauthentication data 1-3 included in an authentication request. Inresponse to a request to authenticate a user, the example authenticationmodule 120 may reference or look-up authentication data in theauthentication table 300 and determine whether a particular registereduser corresponds to the authentication data in the authenticationrequest. Some example embodiments include further authentication data(not shown) to be provided during user authentication. Each useridentification (ID) (e.g., U1, U2) and corresponding authentication datawithin the authentication table 300 may be linked to one or more userrecords within the user table 202, so as to associate a user with theauthentication data. One or more sets of authentication data in thetable 300 may be checked against the weak authentication table 216, soas to identify known weak passwords being used by users.

The weak authentication table 216 is to hold a list of known or derivedweak authentication data. FIG. 4 shows a weak authentication table 400,including weak authentication data, in accordance with an exampleembodiment. The table 400 is shown to include a column 404, 406 for eachof authentication data columns 1-2 and a column for corresponding weakauthentication data 408.

In an example embodiment, the weak authentication table 400 may bedynamic as passwords may be added to and/or removed from the list. Newlyidentified weak passwords may be added to the list in real time,periodically or sporadically (e.g., by an administrator).

The example weak authentication detection table 216 may reference theweak authentication table 400 to compare received passwords with thoselisted in the weak authentication table 400 in column 408. Alternativelyor additionally, the weak authentication detection module 110 may firstderive (e.g., compute) a list of weak passwords from a received usernameand store the weak passwords that have been derived in column 408 of theweak authentication table 400. For example, a submitted username andpassword may be placed in columns 404 and 406 and the password (e.g.,password 111) may be compared to derived substrings to identify whetherthe submitted password matches a weak password.

For the username: “usernameabc” in column 404, the weak authenticationdata derived and written to the table 408 may be “user,” “name,” and“abc” because these strings are substrings of the username. As explainedabove, various other criteria may determine what attributes render apassword weak. Since the example password “password111” in column 406does not match the weak authentication data in column 408, the passwordwould not be considered weak.

The safe device table 208 may hold a list of devices that are designatedas safe or unsafe. FIG. 5 shows a safe device table 500, includingdevice data, in accordance with an example embodiment. The table 500 isshown to include a device data column 504 and a safety indication column506. The safety of particular devices may be known by administrators,for example, to be associated with malicious attacks. Those devices maybe designated unsafe while other devices, based on industry intelligenceor any other information source, may be designated safe. The safe devicetable 208 may be linked to the safe user/device table 210 to associatesafe users with safe devices. Alternatively or additionally, the safedevice table 208 may be accessed by the user/device detection module 132to identify a safe device.

The safe user table 206 may hold a list of users that have previouslybeen determined to be human users. FIG. 6 shows a safe user table 600,including user data, in accordance with an example embodiment. The table600 is shown to include a column for a user 604 (e.g., a user's usernameand password) and a column to indicate whether the user is safe 606(e.g., Yes=“1” and No=“0”), or some other indicator of whether a user issafe, etc.). In some example embodiments, users known to be safe orunsafe populate the table 600.

Alternatively or additionally, the challenge module 130 may populate thefields of the table 600 (e.g., dynamically) based on the results of userchallenges (e.g., CAPTCHAs) presented to users to determine whether auser is human. The safe user table 600 may be linked to the safeuser/device table 210 to associate safe users with safe devices.Alternatively or additionally, the safe user table 206 may be accessedby the user/device detection module 132 to identify a safe user.

The safe user/device table 210 may include a list of safe users thatcorrespond to safe devices. Once the table 210 has been populated, itmay be referenced to determine that a particular authorization requestoriginated from a safe user and device. FIG. 7 shows a safe user/devicetable 700, including safe user and safe device data, in accordance withan example embodiment. The example safe user/device table 700 is shownto include a safe user column 704 and a safe device column 706.

In an example embodiment, the user/device detection module 132 maypopulate the table 700 by first detecting a username, password and IPaddress associated with a request for authorization. The user/devicedetection module 132 may reference the safe user table 600 to determinewhether the user is safe. If the user is safe, the safe device table 500may be referenced to determine whether an IP address of the source hasbeen designated safe or whether a fingerprint of the device associatedwith a safe device.

A device fingerprint may be defined by one or more attributes of adevice. Attributes of a device may include browser type and version,operating system, hardware address, computer name. If the IP address issafe, the safe user (e.g., username/password) and the safe device (e.g.,IP address) may be entered into the safe user/device table 700.

If the user in the example requests access from the same device again,the user/device detection module 132 may be able to reference the singletable 700 to quickly determine that the user from the device is safe(e.g., the user is human and not malicious code or a compromised device)and should be allowed to begin an authorization process.

It is to be appreciated that the determination of whether a user andmachine are safe may be determined by setting and accessing a cookie inthe device requesting authorization or via other device identificationand/or fingerprinting techniques. Such an example technique may beindependent of the use of the user/device table 700 described above.

The trend monitoring table 214 may store records related to userchallenges, authentications, and transactional trends and makeaccessible associations between the numbers of users solving challenges,authenticating and eventually being involved in a transaction.

FIG. 8 is a flow chart illustrating a method 800 of weak authenticationdata limiting, in accordance with an example embodiment. In variousexample embodiments, the method is carried out by the security module108 referred to in FIG. 1.

The method 800 of FIG. 8 begins at block 802 with receiving a requestthat includes authentication data to authenticate a user. In FIG. 1, theexample communication module 140 within the machine 106 may receive therequest through the user interface 102 via the communication channels103, 105, 115 and communication bus 104.

At block 804, the method 800 includes detecting that the authenticationdata included within the request is weak authentication data. In anexample embodiment, the weak authentication detection module 110accesses the weak authentication table 216 in the database 114 to detect(e.g., by referencing a look-up table) that the authentication dataincluded in the request is weak authentication data.

As provided above, authentication data may include authentication datain the form of a username and authentication data in the form of apassword. Example usernames and passwords may be defined by one or morestrings of alphanumeric characters (e.g., see username and password ofFIG. 3 in columns 306, 308). When authentication data includes apassword, whether the password is weak may be determined using thevarious techniques described above.

At block 806, responsive to detecting the weak authentication data, themethod 800 includes determining whether the request to authenticate isassociated with a human user. In an example embodiment, the challengemodule 130 determines (e.g., via a CAPTCHA challenge) that a human useris the source of the request to authenticate.

At block 808, the method 800 includes initiating an authenticationprocess based on determining that the request to authenticate isassociated with a human user. If authentication data include usernameand password, the authentication process may include the authenticationmodule 120 comparing the received username and password to a usernameand a password associated in the authentication table 204 with aregistered user.

In an example embodiment, if the challenge module 130 determines thatthe source of the request is a human user, the authentication module 120responds by initiating the authentication process (e.g., to determinewhether the human user should be allowed to access the machine 106).

A user who successfully authenticates may be offered an option by theoption module 112 to change the weak authentication data to differentauthentication data that is not weak.

If, however, the example challenge module 130 determines that the sourceof the request to authenticate is not human, the example authenticationmodule 120 may stop or reject initiation of the authentication process.

FIG. 9 is a flow chart illustrating a further method 900 of weakauthentication data limiting, in accordance with an example embodiment.Blocks 902, 904 and 906 may include substantially the same method as802-806 in the method 800. Block 908 differs from block 808.

At block 908, the method 900 may include initiating a verificationprocess to determine whether the source of an authentication request isassociated with the human user, based on an initial determination thatthe source of the request is not associated with the human user.

When weak authentication data is detected by the weak authenticationdetection module 110, the user/device detection module 132 within thechallenge module 130 may respond by detecting whether the user haspreviously been determined to be a human user. In an example embodimentthe user/device detection module 132 responds by accessing the safeuser/device table 210 within the database 114 to determine whether thesource of the request can be found on a safe user/device list.

Alternatively or additionally, the user/device detection module 132 maydetect whether the request is associated with a recognized IP address ordevice fingerprint by referencing one or more cookies stored within thesource device or calculating the fingerprint of a device.

If the user/device detection module 132 does not determine the source tobe associated with a human, the challenge module 130 may, in response,initiate a verification process (such as CAPTCHA for example) todetermine whether a source of the request is associated with the humanuser.

FIG. 10 is a block diagram illustrating a network-based system 1000 inaccordance with an example embodiment. A network-based system 1002(e.g., a network-based financial, publication or commerce system)provides server-side functionality via a network 1004 (e.g., theInternet) to one or more clients, such as a web client 1006 (e.g., abrowser, such as the Internet Explorer browser developed by MicrosoftCorporation of Redmond, Wash. or the FireFox browser provided by MozillaCorporation of Mountain View, Calif.), and a programmatic client 1008executing on respective client machines or devices 1010 and 1012. AnApplication Program Interface (API) server 1014 and a web server 1016may be coupled, and provide program and web interfaces respectively, toone or more application servers 1018.

The web client 1006 may be used to access the various commerce andtransaction applications 1020 and 1022 via the web interface supportedby the web server 1016. The example embodiments described herein may beused to prevent malicious software from using the web client 1006 togain unauthorized access (e.g., through brute force attacks) to theapplication servers 1018. In an example embodiment, the buyer, using aweb client 1006, initiates user logins, submits searches for items,browses an electronic marketplace for items, and completes transactionsvia the network 1004 and the web server 1016.

Similarly, the programmatic client 1008 can access the various servicesand functions provided by the publication and transaction applications1020 and 1022 via the program interface of the API server 1014. Theprogrammatic client 1008 may, for example, comprise a seller applicationto access and manage account information located within the applicationservers 1018. The programmatic client 1008 may also enable sellers tosubmit listings to the system 1002 and receive recommended publicationdata in return. In addition to its application to a web client 1006, theexample embodiments described herein may assist in discouragingmalicious software from launching brute force attacks through theprogrammatic client 1008 and the API server 1014.

The application servers 1018 may host one or more publicationapplications 1020 and transaction applications 1022. The applicationservers 1018 may, in turn, be coupled to one or more database servers1024 that facilitate access to one or more databases 1026. In exampleembodiments, the security module 108, as described with respect to FIG.1, may be included within the publication applications 1020, and mayinteract with the database server 1024 and the databases 1026 to accessauthentication data, user information and any other security relatedinformation.

The transaction applications 1022 provide a number of transactionfunctions and services to users that access the system 1002. While thepublication and transaction applications 1020 and 1022 shown in FIG. 10form part of the network-based system 1002, it will be appreciated that,in some embodiments of the subject matter, the transaction applications1022 may form part of a transaction service that is separate anddistinct from the system 1002. The various publication and transactionapplications 1020 and 1022 can also be implemented as standalonesoftware programs with or without individual networking capabilities.

A third party application 1028, executing on a third party servermachine 1030, may also have programmatic (e.g., computer-implemented)access to the network-based system 1002 via the program interface of theAPI server 1014. For example, the third party application 1028 may,utilizing information retrieved from the network-based system 1002,support one or more features or functions on a website hosted by thethird party. The third party website may, for example, provide one ormore promotional, commerce, or payment functions that are supported bythe relevant applications of the network-based system 1002. The securityapplications disclosed herein may further be employed to protect againstbrute force attacks launched from the third party applications 1028.

FIG. 11 is a block diagram illustrating multiple applications 1020 and1022 that, in one example embodiment, are provided as part of thenetworked system 1002. The applications 1020 may be hosted on dedicatedor shared server machines (not shown) that are communicatively coupledto enable communications between server machines. The applicationsthemselves are communicatively coupled (e.g., via appropriateinterfaces) to each other and to various data sources, so as to allowinformation to be passed between the applications or so as to allow theapplications to share and access common data. The applications mayfurthermore access one or more databases 1026 via the database servers1024.

The networked system 1002 may provide a number of publishing, listingand price-setting mechanisms whereby a seller may list (or publishinformation concerning) goods or services for sale, a buyer can expressinterest in or indicate a desire to purchase such goods or services, anda price can be set for a transaction pertaining to the goods orservices. To this end, the publication applications 1020 are shown toinclude at least one publication application 1100 and one or moreauction applications 1102 which support auction-format listing and pricesetting mechanisms (e.g., English, Dutch, Vickrey, Chinese, Double,Reverse auctions etc.). The various auction applications 1102 may alsoprovide a number of features in support of such auction-format listings,such as a reserve price feature whereby a seller may specify a reserveprice in connection with a listing and a proxy-bidding feature whereby abidder may invoke automated proxy bidding.

A number of fixed-price applications 1104 support fixed-price listingformats (e.g., the traditional classified advertisement-type listing ora catalogue listing) and buyout-type listings. Specifically, buyout-typelistings (e.g., including the Buy-It-Now (BIN) technology developed byeBay Inc., of San Jose, Calif.) may be offered in conjunction withauction-format listings, and allow a buyer to purchase goods orservices, which are also being offered for sale via an auction, for afixed-price that is typically higher than the starting price of theauction.

Listing creation applications 1106 allow sellers to conveniently authorlistings pertaining to goods or services that they wish to transact viathe networked system 1002, and listing management applications 1108allow sellers to manage such listings. Specifically, where a particularseller has authored and/or published a large number of listings, themanagement of such listings may present a challenge. The listingmanagement applications 1108 provide a number of features (e.g.,auto-relisting, inventory level monitors, etc.) to assist the seller inmanaging such listings.

Dispute resolution applications 1110 provide mechanisms whereby disputesarising between transacting parties may be resolved. For example, thedispute resolution applications 1110 may provide guided procedureswhereby the parties are guided through a number of steps in an attemptto settle a dispute. In the event that the dispute cannot be settled viathe guided procedures, the dispute may be escalated to a third partymediator or arbitrator.

A number of fraud prevention applications 1112 implement fraud detectionand prevention mechanisms to reduce the occurrence of fraud within thenetworked system 1002.

Messaging applications 1114 are responsible for the generation anddelivery of messages to users of the networked system 1002, suchmessages, for example, advising users regarding the status of listingsat the networked system 1002 (e.g., providing “outbid” notices tobidders during an auction process, to provide user to user transactionalor non-transactional communications or to provide promotional andmerchandising information to users). The messaging applications 1114 maywork in conjunction with or include the communication module 140 ofFIG. 1. Respective messaging applications 1114 may utilize any one of anumber of message delivery networks and platforms to deliver messages tousers. For example, messaging applications 1114 may deliver electronicmail (e-mail), instant message (IM), Short Message Service (SMS), text,facsimile, or voice (e.g., Voice over IP (VoIP)) messages via the wired(e.g., the Internet), Plain Old Telephone Service (POTS), or wireless(e.g., mobile, cellular, WiFi, WiMAX) networks.

Security applications 1116 support various security functions for thepurpose of protecting the networked system 1002 from various types ofattacks. The security applications 1116 or parts thereof may interactwith the fraud prevention applications 1112. In some embodiments, thesecurity applications 1116 may be included within the fraud preventionapplications 1112 and vice versa. Several example embodiments describingthe functions and operations of the security applications are explainedin further detail below.

FIG. 12A is a graphical flow diagram illustrating a method 1200 of weakpassword limiting, in accordance with an example embodiment. The method1200 may be performed by the security applications 1116 of FIG. 11 and,in some embodiments, with the various modules described above withrespect to FIGS. 1, 8 and 9.

The method 1200 begins at process block 1202 with receiving a user loginrequest in the form of a username and password as well as a request toaccess a machine. Referring to FIG. 10, the request may be received fromthe client machine or device 1010 by the application servers 1018.

Blocks 1204 and 1206 show a directive to detect a weak password and atdecision block 1206 that includes detecting whether the passwordreceived at process block 1202 is a weak password. If the password isnot determined to be weak, the method 1200 proceeds to process block1208, which includes a directive to enforce password protection upon thesubmitted username and password. If at decision block 1210 it isdetermined that the login is valid, the process continues at graphicalblock 1212 with allowing the user to access his or her desired page.

If it is detected at decision block 1206 that a weak password wassubmitted, the method 1200 proceeds to process block 1214 and decisionblock 1216, where the method 1200 includes determining whether a user ofa device that submitted the password has previously been recognized asbeing human.

In response to a user not previously being recognized, process block1218 and decision block 1220 include initiating a test (e.g., CAPTCHA)to determine whether the user of the device is currently recognized asbeing human. Any test appropriate to detect whether software or a humanhas submitted a login request may be employed.

FIG. 13 shows an example interface screen 1300, including a CAPTCHA 1301to test a user by requesting that alphanumeric characters are to bereentered into the text box 1302 by a user. In this example userinterface, the user is given the option to change the user's password inlieu of having to reenter the verification code (e.g., the imageCAPTCHA). The user may indicate a desire to change passwords by clickingthe radio button 1303 and then clicking continue 1304. Otherwise, theuser may reenter the verification code and click the continue button1304 to proceed with login.

The user may select radio button 1305 to elect to be reminded to changeits password later. In an example embodiment, a subsequent emailcommunication may be sent giving the recipient an option to initiate thepassword change by following an internet link to a web page hosted bythe example network system. Alternatively or additionally, the user maybe given a web link to the example interface screen (e.g., a web page)1300 at the time of a subsequent weak password detection.

FIG. 14 shows example email notification 1400 providing the option toreplace the weak password, in accordance with an example embodiment. InFIG. 14, the text 1401 indicates to the user that the user's password isnot strong. The text 1402 is a clickable link to one or more additionalweb pages that facilitate the password change process. A user may alsoclick the text 1403 which allows the user to navigate away from the webemail page without initiating the password change process. In someexample embodiments, the user is required to change passwords and is notgiven further access until he or she has done so.

In some example embodiments, a source's failure of the verification test(e.g., indicating that the user is not determined to be human) resultsin the user being looped back in the method 1200 to a repeatedverification test to determine whether the user is human. This isindicated by the arrow labeled “NO” from decision block 1220 to processblock 1218.

If the user has previously been recognized as being human at decisionblock 1216 or if the user is currently recognized as being human (e.g.,the user passes the test indicating that the user has been determined tobe human) at decision block 1220, the process continues at process block1222, where password protection is enforced upon the user submitting theusername and password (see FIG. 12B).

FIG. 12B continues the flow chart of FIG. 12A, following a directive toenforce password protection at process block 1222. At 1224, if a user'susername and password are invalid the method 1200 may return to 1202 atthe beginning of the method to re-start the authentication process. Inan example embodiment, a user is given a number of attempts (e.g.,three) to login before the user is returned to the start of the methodand having to prove he or she is human.

In the event that the login information is valid, process block 1226 anddecision block 1228 may provide the user an option prior to the userbeing authenticated, to replace the weak password with a differentpassword that is not weak (e.g., a strong password) at graphical block1230.

If the user changes passwords or given the option, elects not to changepasswords, the user may be granted access to the desired page asindicated by the graphical block 1232.

In an example embodiment, the number of verification tests (e.g., todetermine whether a user is human) issued responsive to requests toauthenticate are counted (e.g., by the trend monitoring module 150).Likewise, the number of verification tests that have been solved by thesources (e.g., users) are counted. Such information may be used toassess an affect of the verification challenges on users' behavior. In afurther example embodiment, the number of users who proceed toauthenticate after being recognized as being human is counted. Thisexample embodiment includes measuring an impact on transaction flowbased on the numbers of verification tests, solved verification testsand authentications.

FIG. 15 is a block diagram illustrating a computer system or module 1500in accordance with example embodiments. Within the computer system 1500are a set of instructions for causing the machine 1500 to perform anyone or more of the methodologies discussed herein. In alternativeexample embodiments, the machine 1500 operates as a standalone device ormay be connected (e.g., networked) to other machines (not shown). In anetworked deployment, the machine 1500 may operate in the capacity of aserver or a client machine in a server-client network environment, or asa peer machine in a peer-to-peer (or distributed) network environment.The machine 1500 may be a personal computer (PC), a tablet PC, a set-topbox (STB), a PDA, a cellular telephone, a web appliance, a networkrouter, switch or bridge, or any machine capable of executing a set ofinstructions (sequential or otherwise) that specify actions to be takenby that machine. Further, while only a single machine 1500 isillustrated, the term “machine” shall also be taken to include anycollection of machines that individually or jointly execute a set (ormultiple sets) of instructions to perform any one or more of themethodologies discussed herein.

The example computer system 1500 includes a processor 1502 (e.g., acentral processing unit (CPU), a graphics processing unit (GPU) orboth), a main memory 1504 and a static memory 1506, which communicatewith each other via a bus 1508. The computer system 1500 may furtherinclude a video display unit 1510 (e.g., a liquid crystal display (LCD)or a cathode ray tube (CRT)). The computer system 1500 also includes analphanumeric input device 1512 (e.g., a keyboard), a user interface (UI)navigation device 1514 (e.g., a mouse), a disk drive unit 1516, a signalgeneration device 1518 (e.g., a speaker) and a network interface device1520.

The disk drive unit 1516 includes a machine-readable medium 1522 onwhich is stored one or more sets of instructions and data structures(e.g., instructions 1524) embodying or utilized by any one or more ofthe methodologies or functions described herein. The instructions 1524may also reside, completely or at least partially, within the mainmemory 1504 and/or within the processor 1502 during execution thereof bythe computer system 1500, the main memory 1504 and the processor 1502also constituting machine-readable media.

The instructions 1524 may further be transmitted or received over anetwork 1526 via the network interface device 1520 utilizing any one ofa number of well-known transfer protocols (e.g., file transfer protocol(FTP)).

While the machine-readable medium 1522 is shown in an example embodimentto be a single medium, the term “machine-readable medium” should betaken to include a single medium or multiple media (e.g., a centralizedor distributed database, and/or associated caches and servers) thatstore the one or more sets of instructions. The term “machine-readablemedium” shall also be taken to include any medium that is capable ofstoring, encoding or carrying a set of instructions for execution by themachine and that cause the machine to perform any one or more of themethodologies of the present invention, or that is capable of storing,encoding or carrying data structures utilized by or associated with sucha set of instructions. The term “machine-readable medium” shallaccordingly be taken to include, but not be limited to, solid-statememories, optical and magnetic media, and carrier wave signals.

The above description is intended to be illustrative, and notrestrictive. For example, the above-described embodiments (or one ormore aspects thereof) may be used in combination with each other. Otherembodiments will be apparent to those of skill in the art upon reviewingthe above description. The scope of the claims should, therefore, bedetermined with reference to the appended claims, along with the fullscope of equivalents to which such claims are entitled. In the appendedclaims, the terms “including” and “in which” are used as theplain-English equivalents of the respective terms “comprising” and“wherein.” Also, in the following claims, the terms “including” and“comprising” are open-ended, that is, a system, device, article, orprocess that includes elements in addition to those listed after such aterm in a claim are still deemed to fall within the scope of that claim.Moreover, in the following claims, the terms “first,” “second,” and“third,” etc., are used merely as labels, and are not intended to imposenumerical requirements on their objects.

The Abstract is provided to comply with 37 C.F.R. §1.72(b), whichrequires that it allow the reader to quickly ascertain the nature of thetechnical disclosure. It is submitted with the understanding that itwill not be used to interpret or limit the scope or meaning of theclaims. Also, in the above Detailed Description, various features may begrouped together to streamline the disclosure. This should not beinterpreted as intending that an unclaimed disclosed feature isessential to any claim. Rather, inventive subject matter may lie in lessthan all features of a particular disclosed embodiment. Thus, thefollowing claims are hereby incorporated into the Detailed Description,with each claim standing on its own as a separate embodiment.

What is claimed is:
 1. A method comprising: receiving a request toauthenticate a device, the request including authentication data and anidentifier of the device, the request being received over a network;determining that the authentication data is a substring of a useridentifier; determining that the identifier of the device was notpreviously associated with a human user; and responsive to determiningthat the authentication data is the substring of the user identifier andthat the identifier of the device was not previously associated with ahuman user, determining, using one or more hardware processors, that theidentifier of the device is associated with a human user by initiating averification process.
 2. The method of claim 1, wherein the verificationprocess includes a challenge-response test that includes a text box toreceive alphanumeric characters that appear in an image.
 3. The methodof claim 1, further comprising: responsive to determining that theidentifier of the device is associated with a human user as a result ofthe verification process, initiating an authentication process toreplace the authentication data.
 4. The method of claim 3, wherein theauthentication process to replace the authentication data includesproviding an option to replace the authentication data with furtherauthentication data.
 5. The method of claim 4, wherein the option toreplace the authentication data is presented via a web link.
 6. Themethod of claim 1, wherein the identifier of the device includes atleast one of: a device fingerprint; an Internet Protocol address of thedevice; or a version of an operation system being executed on thedevice.
 7. The method of claim 6, wherein the determining that theidentifier of the device is associated with a human user includesdetermining that the identifier of the device is previously recognized.8. The method of claim 1, wherein the determining that the identifier ofthe device is associated with a human user includes accessing a cookiefrom the device.
 9. The method of claim 1, further comprising:determining a trend for the verification process across multiple users;and storing a record of the determined trend in a database.
 10. Themethod of claim 1, wherein: the authentication data includes both afirst string and a second string; and the method further comprisesdetermining that the first string is a subset of the second string. 11.A system comprising: one or more processors; and a memory storingexecutable instructions that, when executed by the one or moreprocessors, cause the one or more processors to perform operationscomprising: receiving a request to authenticate a device, the requestincluding authentication data and an identifier of the device, therequest being received over a network; determining that theauthentication data is a substring of a user identifier; determiningthat the identifier of the device was not previously associated with ahuman user; and responsive to determining that the authentication datais the substring of the user identifier and that the identifier of thedevice was not previously associated with a human user, determining thatthe identifier of the device is associated with a human user byinitiating a verification process.
 12. The system of claim 11, whereinthe verification process includes a challenge-response test thatincludes a text box to receive alphanumeric characters that appear in animage.
 13. The system of claim 11, wherein the operations furthercomprise responsive to determining that the identifier of the device isassociated with a human user as a result of the verification process,initiating an authentication process to replace the authentication data.14. The system of claim 13, wherein the authentication process toreplace the authentication data includes providing an option to replacethe authentication data with further authentication data.
 15. The systemof claim 14, wherein the option to replace the authentication data ispresented via a web link.
 16. The system of claim 11, wherein theidentifier of the device includes at least one of: a device fingerprint;an Internet Protocol address of the device; or a version of an operationsystem being executed on the device.
 17. The system of claim 16, whereinthe determining that the identifier of the device is associated with ahuman user includes determining that the identifier of the device ispreviously recognized.
 18. The system of claim 11, wherein thedetermining that the identifier of the device is associated with a humanuser includes accessing a cookie from the device.
 19. The system ofclaim 11, further comprising: determining a trend for the verificationprocess across multiple users; and storing a record of the determinedtrend in a database.
 20. A non-transitory machine-readable mediumstoring instructions that, when executed by one or more processors of amachine, cause the machine to perform operations comprising: receiving arequest to authenticate a device, the request including authenticationdata and an identifier of the device, the request being received over anetwork; determining that the authentication data is a substring of auser identifier; determining that the identifier of the device was notpreviously associated with a human user; and responsive to determiningthat the authentication data is the substring of the user identifier andthat the identifier of the device was not previously associated with ahuman user, determining that the identifier of the device is associatedwith a human user by initiating a verification process.